If the site you're injecting HTML into has some crazy HTTP headers set (Access-Control-Allow-Origin: *) then yes you can: https://stackoverflow.com/a/25861695/

If the site you're injecting HTML into has some crazy HTTP headers set (Access-Control-Allow-Origin: *) then yes you can: https://stackoverflow.com/a/25861695/235908 https://stackoverflow.com/a/25861695/235908 By default you cannot. If the site you're testing with allows arbitrary image embeds, maybe they're that crazy, since even without stealing cookies you can still gzip bomb: https://bomb.codes https://bomb.codes